lurqrun 0.1.6 → 0.1.7

package/dist/chunk-63MUJNZL.js

@@ -0,0 +1,318 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  require_dist
+} from "./chunk-QKGYDMWB.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/audit/inventory.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+import { existsSync, readFileSync, readdirSync } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join, relative, resolve } from "path";
+var DEP_SECTIONS = ["dependencies", "devDependencies", "optionalDependencies"];
+var MAX_ITEMS = 600;
+var MAX_TRANSITIVES = 4e3;
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function splitSpec(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return { name: spec, version: null };
+  const name = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!/^\d/.test(version)) return { name, version: null };
+  return { name, version };
+}
+var NPM_RUNNERS = /* @__PURE__ */ new Set(["npx", "bunx", "pnpx"]);
+var RUNNER_FLAGS = /* @__PURE__ */ new Set(["-y", "--yes", "--no-install", "--silent", "-q", "--quiet", "-p"]);
+var OTHER_RUNNERS = /* @__PURE__ */ new Set(["uvx", "pipx", "uv", "pip", "python", "python3", "go", "cargo"]);
+function classifyServer(alias, raw) {
+  const base = { alias, packageName: null, version: null, endpoint: null };
+  if (typeof raw.url === "string" && raw.url) {
+    let endpoint = raw.url;
+    try {
+      endpoint = new URL(raw.url).host;
+    } catch {
+    }
+    return { ...base, kind: "remote", endpoint };
+  }
+  const command = typeof raw.command === "string" ? raw.command : "";
+  const args = Array.isArray(raw.args) ? raw.args.filter((a) => typeof a === "string") : [];
+  const bin = command.split(/[\\/]/).pop() ?? "";
+  if (OTHER_RUNNERS.has(bin)) return { ...base, kind: "other-registry" };
+  if (NPM_RUNNERS.has(bin) || bin === "pnpm" && args[0] === "dlx") {
+    const rest = bin === "pnpm" ? args.slice(1) : args;
+    const spec = rest.find((a) => !a.startsWith("-") && !RUNNER_FLAGS.has(a));
+    if (!spec) return { ...base, kind: "npm-stdio" };
+    const { name, version } = splitSpec(spec);
+    return { ...base, kind: "npm-stdio", packageName: name, version };
+  }
+  return { ...base, kind: "local" };
+}
+function serversFromConfig(config, file) {
+  if (!config || typeof config !== "object") return [];
+  const out = [];
+  for (const section of ["mcpServers", "servers"]) {
+    const block = config[section];
+    if (!block || typeof block !== "object") continue;
+    for (const [alias, raw] of Object.entries(block)) {
+      if (!raw || typeof raw !== "object") continue;
+      out.push({
+        ...classifyServer(alias, raw),
+        sources: [{ file, section }]
+      });
+    }
+  }
+  return out;
+}
+function mcpConfigPaths(root, home = homedir()) {
+  return [
+    join(root, ".mcp.json"),
+    join(root, ".cursor", "mcp.json"),
+    join(root, ".vscode", "mcp.json"),
+    join(root, ".windsurf", "mcp.json"),
+    join(home, ".claude.json"),
+    join(home, ".cursor", "mcp.json"),
+    join(home, ".codeium", "windsurf", "mcp_config.json"),
+    join(home, ".gemini", "settings.json")
+  ];
+}
+function installedFrom(root, name, lock) {
+  const pkgJson = join(root, "node_modules", ...name.split("/"), "package.json");
+  if (existsSync(pkgJson)) {
+    const m = readJson(pkgJson);
+    if (m && typeof m.version === "string") return m.version;
+  }
+  return lock.get(name) ?? null;
+}
+function readLockTree(root) {
+  const installs = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  const lock = readJson(join(root, "package-lock.json"));
+  if (!lock) return { installs, edges, present: false };
+  const addEdge = (parent, child) => {
+    if (!parent || !child || parent === child) return;
+    const set = edges.get(parent);
+    if (set) set.add(child);
+    else edges.set(parent, /* @__PURE__ */ new Set([child]));
+  };
+  for (const [path, entry] of Object.entries(lock.packages ?? {})) {
+    const idx = path.lastIndexOf("node_modules/");
+    if (idx < 0) continue;
+    const name = path.slice(idx + "node_modules/".length);
+    if (!name) continue;
+    if (typeof entry?.version === "string" && !installs.has(name))
+      installs.set(name, entry.version);
+    for (const dep of Object.keys(entry?.dependencies ?? {})) addEdge(name, dep);
+    for (const dep of Object.keys(entry?.optionalDependencies ?? {})) addEdge(name, dep);
+  }
+  for (const [name, entry] of Object.entries(lock.dependencies ?? {})) {
+    if (typeof entry?.version === "string" && !installs.has(name))
+      installs.set(name, entry.version);
+    for (const dep of Object.keys(entry?.dependencies ?? {})) addEdge(name, dep);
+  }
+  return { installs, edges, present: true };
+}
+function readLockfile(root) {
+  return readLockTree(root).installs;
+}
+function attributeTree(directs, edges, maxDepth = 12) {
+  const via = /* @__PURE__ */ new Map();
+  for (const root of directs) {
+    const seen = /* @__PURE__ */ new Set([root]);
+    let frontier = [root];
+    for (let depth = 0; depth < maxDepth && frontier.length; depth++) {
+      const next = [];
+      for (const node of frontier) {
+        for (const child of edges.get(node) ?? []) {
+          if (seen.has(child)) continue;
+          seen.add(child);
+          next.push(child);
+          const list = via.get(child);
+          if (list) {
+            if (!list.includes(root)) list.push(root);
+          } else via.set(child, [root]);
+        }
+      }
+      frontier = next;
+    }
+  }
+  return via;
+}
+var MAX_WORKSPACE_DEPTH = 5;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "coverage", ".git", ".next"]);
+function workspacePatterns(root) {
+  const m = readJson(join(root, "package.json"));
+  const fromNpm = Array.isArray(m?.workspaces) ? m.workspaces : Array.isArray(m?.workspaces?.packages) ? m.workspaces.packages : [];
+  const pnpmPath = join(root, "pnpm-workspace.yaml");
+  let fromPnpm = [];
+  if (existsSync(pnpmPath)) {
+    try {
+      const doc = (0, import_yaml.parse)(readFileSync(pnpmPath, "utf8"));
+      if (Array.isArray(doc?.packages)) fromPnpm = doc.packages;
+    } catch {
+    }
+  }
+  return [...fromNpm, ...fromPnpm].filter((p) => typeof p === "string");
+}
+function childDirs(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !SKIP_DIRS.has(e.name) && !e.name.startsWith(".")).map((e) => join(dir, e.name));
+  } catch {
+    return [];
+  }
+}
+function expandWorkspaces(root, patterns) {
+  const includes = patterns.filter((p) => !p.startsWith("!"));
+  const excludes = patterns.filter((p) => p.startsWith("!")).map((p) => resolve(root, p.slice(1).replace(/\/\*+$/, "")));
+  const dirs = /* @__PURE__ */ new Set();
+  for (const pattern of includes) {
+    const deep = /\/\*\*$/.test(pattern);
+    const shallow = !deep && /\/\*$/.test(pattern);
+    const base = resolve(root, pattern.replace(/\/\*+$/, ""));
+    if (!existsSync(base)) continue;
+    if (!deep && !shallow) {
+      dirs.add(base);
+      continue;
+    }
+    let frontier = childDirs(base);
+    for (const d of frontier) dirs.add(d);
+    if (!deep) continue;
+    for (let depth = 1; depth < MAX_WORKSPACE_DEPTH && frontier.length; depth++) {
+      const next = frontier.flatMap(childDirs);
+      for (const d of next) dirs.add(d);
+      frontier = next;
+    }
+  }
+  const out = [];
+  for (const dir of dirs) {
+    if (excludes.some((x) => dir === x || dir.startsWith(`${x}/`))) continue;
+    const manifest = join(dir, "package.json");
+    if (existsSync(manifest)) out.push(manifest);
+  }
+  return out.sort();
+}
+function collectInventory(root, opts = {}) {
+  const abs = resolve(root);
+  const max = opts.maxItems ?? MAX_ITEMS;
+  const filesRead = [];
+  const notes = [];
+  const rel = (p) => isAbsolute(p) && p.startsWith(abs) ? relative(abs, p) || "." : p;
+  const byName = /* @__PURE__ */ new Map();
+  const rootManifest = join(abs, "package.json");
+  const manifests = [];
+  if (existsSync(rootManifest)) {
+    manifests.push(rootManifest);
+    manifests.push(...expandWorkspaces(abs, workspacePatterns(abs)));
+  } else {
+    notes.push(`no package.json at ${abs}; npm half of the audit is empty`);
+  }
+  const tree = readLockTree(abs);
+  const lock = tree.installs;
+  for (const path of manifests) {
+    const m = readJson(path);
+    if (!m) {
+      notes.push(`could not parse ${rel(path)}`);
+      continue;
+    }
+    filesRead.push(rel(path));
+    for (const section of DEP_SECTIONS) {
+      const block = m[section];
+      if (!block || typeof block !== "object") continue;
+      for (const [name, range] of Object.entries(block)) {
+        if (typeof range !== "string") continue;
+        const src = { file: rel(path), section };
+        const seen = byName.get(name);
+        if (seen) {
+          seen.sources.push(src);
+          continue;
+        }
+        byName.set(name, {
+          name,
+          range,
+          installed: installedFrom(abs, name, lock),
+          sources: [src]
+        });
+      }
+    }
+  }
+  const byAlias = /* @__PURE__ */ new Map();
+  for (const path of mcpConfigPaths(abs, opts.home)) {
+    if (opts.projectOnly && !path.startsWith(abs)) continue;
+    if (!existsSync(path)) continue;
+    const cfg = readJson(path);
+    if (!cfg) {
+      notes.push(`could not parse ${rel(path)}`);
+      continue;
+    }
+    const found = serversFromConfig(cfg, rel(path));
+    if (found.length) filesRead.push(rel(path));
+    for (const s of found) {
+      const key = s.packageName ?? s.endpoint ?? `${s.kind}:${s.alias}`;
+      const seen = byAlias.get(key);
+      if (seen) {
+        seen.sources.push(...s.sources);
+        seen.version ??= s.version;
+        continue;
+      }
+      byAlias.set(key, s);
+    }
+  }
+  const packages = [...byName.values()];
+  const mcpServers = [...byAlias.values()];
+  const directNames = new Set(byName.keys());
+  const via = attributeTree([...directNames], tree.edges);
+  const transitives = [];
+  for (const [name, version] of tree.installs) {
+    if (directNames.has(name)) continue;
+    if (transitives.length >= MAX_TRANSITIVES) {
+      notes.push(
+        `resolved tree exceeds ${MAX_TRANSITIVES} installs; the remainder were not checked for vulnerabilities`
+      );
+      break;
+    }
+    transitives.push({ name, version, via: via.get(name) ?? [] });
+  }
+  if (!tree.present && packages.length > 0) {
+    notes.push(
+      "no package-lock.json, so the dependency tree below your manifest was never read \u2014 transitive vulnerabilities are NOT covered by this run"
+    );
+  }
+  const total = packages.length + mcpServers.length;
+  if (total > max) {
+    notes.push(
+      `${total} items discovered, auditing the first ${max}; the remainder are reported as truncated rather than dropped`
+    );
+  }
+  return {
+    root: abs,
+    packages: packages.slice(0, max),
+    mcpServers: mcpServers.slice(0, Math.max(0, max - packages.length)),
+    transitives,
+    filesRead,
+    notes
+  };
+}
+
+export {
+  MAX_ITEMS,
+  MAX_TRANSITIVES,
+  splitSpec,
+  classifyServer,
+  serversFromConfig,
+  mcpConfigPaths,
+  readLockTree,
+  readLockfile,
+  attributeTree,
+  workspacePatterns,
+  expandWorkspaces,
+  collectInventory
+};